libarchive/contribs9/libarchive-2.8.3-rhbz-1347086.patch

From 756b671031e0f6158f82186220ebc087c44cd985 Mon Sep 17 00:00:00 2001
From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 10 Jan 2015 12:24:58 -0800
Subject: [PATCH] Fix a potential crash issue discovered by Alexander
 Cherepanov:

It seems bsdtar automatically handles stacked compression. This is a
nice feature but it could be problematic when it's completely
unlimited.  Most clearly it's illustrated with quines:

$ curl -sRO http://www.maximumcompression.com/selfgz.gz
$ (ulimit -v 10000000 && bsdtar -tvf selfgz.gz)
bsdtar: Error opening archive: Can't allocate data for gzip decompression

Without ulimit, bsdtar will eat all available memory. This could also
be a problem for other applications using libarchive.
---
 Makefile.am                                      |  2 ++
 libarchive/archive_read.c                        |  7 ++--
 libarchive/test/test_read_too_many_filters.c     | 45 ++++++++++++++++++++++++
 libarchive/test/test_read_too_many_filters.gz.uu | 15 ++++++++
 4 files changed, 67 insertions(+), 2 deletions(-)
 create mode 100644 libarchive/test/test_read_too_many_filters.c
 create mode 100644 libarchive/test/test_read_too_many_filters.gz.uu

diff --git a/Makefile.am b/Makefile.am
index 9b0632b..5cfef49 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -294,6 +294,7 @@ libarchive_test_SOURCES=                                    \
        libarchive/test/test_read_large.c                       \
        libarchive/test/test_read_pax_truncated.c               \
        libarchive/test/test_read_position.c                    \
+       libarchive/test/test_read_too_many_filters.c            \
        libarchive/test/test_read_truncated.c                   \
        libarchive/test/test_read_uu.c                          \
        libarchive/test/test_tar_filenames.c                    \
@@ -380,6 +381,7 @@ libarchive_test_EXTRA_DIST=\
        libarchive/test/test_read_format_raw.data.uu                    \
        libarchive/test/test_read_format_tar_empty_filename.tar.uu      \
        libarchive/test/test_read_format_zip.zip.uu                     \
+       libarchive/test/test_read_too_many_filters.gz.uu                \
        libarchive/test/CMakeLists.txt                                  \
        libarchive/test/README
 
diff --git a/libarchive/archive_read.c b/libarchive/archive_read.c
index f39f5ce..92d67d9 100644
--- a/libarchive/archive_read.c
+++ b/libarchive/archive_read.c
@@ -352,13 +352,13 @@ archive_read_open2(struct archive *_a, void *client_data,
 static int
 build_stream(struct archive_read *a)
 {
-       int number_bidders, i, bid, best_bid;
+       int number_bidders, i, bid, best_bid, n;
        struct archive_read_filter_bidder *bidder, *best_bidder;
        struct archive_read_filter *filter;
        ssize_t avail;
        int r;
 
-       for (;;) {
+       for (n = 0; n < 25; ++n) {
                number_bidders = sizeof(a->bidders) / sizeof(a->bidders[0]);
 
                best_bid = 0;
@@ -402,6 +402,9 @@ build_stream(struct archive_read *a)
                        return (ARCHIVE_FATAL);
                }
        }
+       archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+           "Input requires too many filters for decoding");
+       return (ARCHIVE_FATAL);
 }
 
 /*
diff --git a/libarchive/test/test_read_too_many_filters.c b/libarchive/test/test_read_too_many_filters.c
new file mode 100644
index 0000000..37cab24
--- /dev/null
+++ b/libarchive/test/test_read_too_many_filters.c
@@ -0,0 +1,45 @@
+/*-
+ * Copyright (c) 2003-2008,2015 Tim Kientzle
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "test.h"
+
+DEFINE_TEST(test_read_too_many_filters)
+{
+       const char *name = "test_read_too_many_filters.gz";
+       struct archive *a;
+       int r;
+
+       assert((a = archive_read_new()) != NULL);
+       r = archive_read_support_compression_gzip(a);
+       if (r == ARCHIVE_WARN) {
+               skipping("gzip reading not fully supported on this platform");
+       }
+       assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
+       extract_reference_file(name);
+       assertEqualIntA(a, ARCHIVE_FATAL,
+           archive_read_open_filename(a, name, 200));
+
+       assertEqualInt(ARCHIVE_OK, archive_read_close(a));
+       assertEqualInt(ARCHIVE_OK, archive_read_finish(a));
+}
diff --git a/libarchive/test/test_read_too_many_filters.gz.uu b/libarchive/test/test_read_too_many_filters.gz.uu
new file mode 100644
index 0000000..6bf6614
--- /dev/null
+++ b/libarchive/test/test_read_too_many_filters.gz.uu
@@ -0,0 +1,15 @@
+This is a valid gzip file that decompresses to itself, from
+  http://www.maximumcompression.com/selfgz.gz
+
+This is used in test_read_too_many_filters to try to
+crash libarchive by forcing it to spawn an unending
+list of gunzip filters.
+
+begin 644 test_read_too_many_filters.gz
+M'XL(`````````P`/`/#_'XL(`````````P`/`/#_````__\```#__X)QH5P`
+M`!X`X?\```#__P```/__@G&A7```'@#A_P```/__````__\```#__P```/__
+M````__\```#__\(FAF`!`!0`Z_\```#__P```/__PB:&8`$`%`#K_\(FAF`!
+M`!0`Z_^9(#6-B"@Q,C,T`K/`+```%`#K_P*SP"P``!0`Z_]"B"'$`````/__
+>`P!#2DTAT@```$*((<0`````__\#`$-*32'2````
+`
+end
-- 
2.7.4

1	jpp	1.1	From 756b671031e0f6158f82186220ebc087c44cd985 Mon Sep 17 00:00:00 2001
2			From: Tim Kientzle <kientzle@acm.org>
3			Date: Sat, 10 Jan 2015 12:24:58 -0800
4			Subject: [PATCH] Fix a potential crash issue discovered by Alexander
5			Cherepanov:
6
7			It seems bsdtar automatically handles stacked compression. This is a
8			nice feature but it could be problematic when it's completely
9			unlimited. Most clearly it's illustrated with quines:
10
11			$ curl -sRO http://www.maximumcompression.com/selfgz.gz
12			$ (ulimit -v 10000000 && bsdtar -tvf selfgz.gz)
13			bsdtar: Error opening archive: Can't allocate data for gzip decompression
14
15			Without ulimit, bsdtar will eat all available memory. This could also
16			be a problem for other applications using libarchive.
17			---
18			Makefile.am \| 2 ++
19			libarchive/archive_read.c \| 7 ++--
20			libarchive/test/test_read_too_many_filters.c \| 45 ++++++++++++++++++++++++
21			libarchive/test/test_read_too_many_filters.gz.uu \| 15 ++++++++
22			4 files changed, 67 insertions(+), 2 deletions(-)
23			create mode 100644 libarchive/test/test_read_too_many_filters.c
24			create mode 100644 libarchive/test/test_read_too_many_filters.gz.uu
25
26			diff --git a/Makefile.am b/Makefile.am
27			index 9b0632b..5cfef49 100644
28			--- a/Makefile.am
29			+++ b/Makefile.am
30			@@ -294,6 +294,7 @@ libarchive_test_SOURCES= \
31			libarchive/test/test_read_large.c \
32			libarchive/test/test_read_pax_truncated.c \
33			libarchive/test/test_read_position.c \
34			+ libarchive/test/test_read_too_many_filters.c \
35			libarchive/test/test_read_truncated.c \
36			libarchive/test/test_read_uu.c \
37			libarchive/test/test_tar_filenames.c \
38			@@ -380,6 +381,7 @@ libarchive_test_EXTRA_DIST=\
39			libarchive/test/test_read_format_raw.data.uu \
40			libarchive/test/test_read_format_tar_empty_filename.tar.uu \
41			libarchive/test/test_read_format_zip.zip.uu \
42			+ libarchive/test/test_read_too_many_filters.gz.uu \
43			libarchive/test/CMakeLists.txt \
44			libarchive/test/README
45
46			diff --git a/libarchive/archive_read.c b/libarchive/archive_read.c
47			index f39f5ce..92d67d9 100644
48			--- a/libarchive/archive_read.c
49			+++ b/libarchive/archive_read.c
50			@@ -352,13 +352,13 @@ archive_read_open2(struct archive _a, void client_data,
51			static int
52			build_stream(struct archive_read *a)
53			{
54			- int number_bidders, i, bid, best_bid;
55			+ int number_bidders, i, bid, best_bid, n;
56			struct archive_read_filter_bidder bidder, best_bidder;
57			struct archive_read_filter *filter;
58			ssize_t avail;
59			int r;
60
61			- for (;;) {
62			+ for (n = 0; n < 25; ++n) {
63			number_bidders = sizeof(a->bidders) / sizeof(a->bidders[0]);
64
65			best_bid = 0;
66			@@ -402,6 +402,9 @@ build_stream(struct archive_read *a)
67			return (ARCHIVE_FATAL);
68			}
69			}
70			+ archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
71			+ "Input requires too many filters for decoding");
72			+ return (ARCHIVE_FATAL);
73			}
74
75			/*
76			diff --git a/libarchive/test/test_read_too_many_filters.c b/libarchive/test/test_read_too_many_filters.c
77			new file mode 100644
78			index 0000000..37cab24
79			--- /dev/null
80			+++ b/libarchive/test/test_read_too_many_filters.c
81			@@ -0,0 +1,45 @@
82			+/*-
83			+ * Copyright (c) 2003-2008,2015 Tim Kientzle
84			+ * All rights reserved.
85			+ *
86			+ * Redistribution and use in source and binary forms, with or without
87			+ * modification, are permitted provided that the following conditions
88			+ * are met:
89			+ * 1. Redistributions of source code must retain the above copyright
90			+ * notice, this list of conditions and the following disclaimer.
91			+ * 2. Redistributions in binary form must reproduce the above copyright
92			+ * notice, this list of conditions and the following disclaimer in the
93			+ * documentation and/or other materials provided with the distribution.
94			+ *
95			+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
96			+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
97			+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
98			+ * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
99			+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
100			+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
101			+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
102			+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
103			+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
104			+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
105			+ */
106			+#include "test.h"
107			+
108			+DEFINE_TEST(test_read_too_many_filters)
109			+{
110			+ const char *name = "test_read_too_many_filters.gz";
111			+ struct archive *a;
112			+ int r;
113			+
114			+ assert((a = archive_read_new()) != NULL);
115			+ r = archive_read_support_compression_gzip(a);
116			+ if (r == ARCHIVE_WARN) {
117			+ skipping("gzip reading not fully supported on this platform");
118			+ }
119			+ assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a));
120			+ extract_reference_file(name);
121			+ assertEqualIntA(a, ARCHIVE_FATAL,
122			+ archive_read_open_filename(a, name, 200));
123			+
124			+ assertEqualInt(ARCHIVE_OK, archive_read_close(a));
125			+ assertEqualInt(ARCHIVE_OK, archive_read_finish(a));
126			+}
127			diff --git a/libarchive/test/test_read_too_many_filters.gz.uu b/libarchive/test/test_read_too_many_filters.gz.uu
128			new file mode 100644
129			index 0000000..6bf6614
130			--- /dev/null
131			+++ b/libarchive/test/test_read_too_many_filters.gz.uu
132			@@ -0,0 +1,15 @@
133			+This is a valid gzip file that decompresses to itself, from
134			+ http://www.maximumcompression.com/selfgz.gz
135			+
136			+This is used in test_read_too_many_filters to try to
137			+crash libarchive by forcing it to spawn an unending
138			+list of gunzip filters.
139			+
140			+begin 644 test_read_too_many_filters.gz
141			+M'XL(`````````P`/`/#_'XL(`````````P`/`/#_````__\```#__X)QH5P`
142			+M`!X`X?\```#__P```/__@G&A7```'@#A_P```/__````__\```#__P```/__
143			+M````__\```#__\(FAF`!`!0`Z_\```#__P```/__PB:&8`$`%`#K_\(FAF`!
144			+M`!0`Z_^9(#6-B"@Q,C,T`K/`+```%`#K_P*SP"P``!0`Z_]"B"'$`````/__
145			+>`P!#2DTAT@```$((<0`````__\#`$-32'2````
146			+`
147			+end
148			--
149			2.7.4
150